Still seems wrong: Caller passes len=500, generic_sb_sasl_write()
returns 0 or -1 with LDAP_PVT_SASL_PARTIAL_WRITE, caller collects 300
more bytes and passes len=800, then generic_sb_sasl_write() ignores
not 500 but 800 bytes and tells caller that they were all written.

Technically this is true, if you look at it in isolation, but overall the code
doesn't work that way. Only ber_flush2() is ever used for actual I/O, and that
can only flush one BerElement at a time, and the BerElement doesn't change.
I.e., you can't "collect 300 more bytes" and pass it in on the retry, it's
simply not possible in the API.

Either make p->flags a ber_slen_t with the number of incoming bytes to
ignore, or after p->ops->encode() = success, write() =<partial write
or non-fatal error> return len-1 with with LDAP_PVT_SASL_PARTIAL_WRITE.